Sylpheed

When Sylpheed connects to an IMAP/SMTP/POP server over SSL, it does not check the hostname on the SSL certificate. This is a major security problem, because it means an attacker can man-in-the-middle a SSL connection by purchasing a valid certificate for his/her own domain and using it in the attack. Since the certificate is valid, Sylpheed accepts it, even though it's not for the hostname Sylpheed thinks it's connecting to.

The attached patch fixes the problem by making sure the name on the certificate matches the hostname Sylpheed is connecting to. The code to properly check a certificate's hostname with OpenSSL is not simple, so I used the MIT-licensed example code provided here: https://github.com/iSECPartners/ssl-conservatory